===================================Documentation for /proc/sys/kernel/=================================== .. See scripts/check-sysctl-docs to keep this up to date Copyright (c) 1998, 1999, Rik van Riel <riel@nl.linux.org> Copyright (c) 2009, Shen Feng<shen@cn.fujitsu.com> For general info and legal blurb, please look inDocumentation/admin-guide/sysctl/index.rst. ------------------------------------------------------------------------------ This file contains documentation for the sysctl files in``/proc/sys/kernel/``. The files in this directory can be used to tune and monitormiscellaneous and general things in the operation of the Linuxkernel. Since some of the files *can* be used to screw up yoursystem, it is advisable to read both documentation and sourcebefore actually making adjustments. Currently, these files might (depending on your configuration)show up in ``/proc/sys/kernel``: .. contents:: :local: acct==== :: highwater lowwater frequency If BSD-style process accounting is enabled these values controlits behaviour. If free space on filesystem where the log livesgoes below ``lowwater``\ % accounting suspends. If free space getsabove ``highwater``\ % accounting resumes. ``frequency`` determineshow often do we check the amount of free space (value is inseconds). Default: :: 4 2 30 That is, suspend accounting if free space drops below 2%; resume itif it increases to at least 4%; consider information about amount offree space valid for 30 seconds. acpi_video_flags================ See Documentation/power/video.rst. This allows the video resume mode to be set,in a similar fashion to the ``acpi_sleep`` kernel parameter, bycombining the following values: = =======1 s3_bios2 s3_mode4 s3_beep= ======= arch==== The machine hardware name, the same output as ``uname -m``(e.g. ``x86_64`` or ``aarch64``). auto_msgmni=========== This variable has no effect and may be removed in future kernelreleases. Reading it always returns 0.Up to Linux 3.17, it enabled/disabled automatic recomputing of`msgmni`_upon memory add/remove or upon IPC namespace creation/removal.Echoing "1" into this file enabled msgmni automatic recomputing.Echoing "0" turned it off. The default value was 1. bootloader_type (x86 only)========================== This gives the bootloader type number as indicated by the bootloader,shifted left by 4, and OR'd with the low four bits of the bootloaderversion. The reason for this encoding is that this used to match the``type_of_loader`` field in the kernel header; the encoding is kept forbackwards compatibility. That is, if the full bootloader type numberis 0x15 and the full version number is 0x234, this file will containthe value 340 = 0x154. See the ``type_of_loader`` and ``ext_loader_type`` fields inDocumentation/arch/x86/boot.rst for additional information. bootloader_version (x86 only)============================= The complete bootloader version number. In the example above, thisfile will contain the value 564 = 0x234. See the ``type_of_loader`` and ``ext_loader_ver`` fields inDocumentation/arch/x86/boot.rst for additional information. bpf_stats_enabled================= Controls whether the kernel should collect statistics on BPF programs(total time spent running, number of times run...). Enablingstatistics causes a slight reduction in performance on each programrun. The statistics can be seen using ``bpftool``. = ===================================0 Don't collect statistics (default).1 Collect statistics.= =================================== cad_pid======= This is the pid which will be signalled on reboot (notably, byCtrl-Alt-Delete). Writing a value to this file which doesn'tcorrespond to a running process will result in ``-ESRCH``. See also `ctrl-alt-del`_. cap_last_cap============ Highest valid capability of the running kernel. Exports``CAP_LAST_CAP`` from the kernel. .. _core_pattern: core_pattern============ ``core_pattern`` is used to specify a core dumpfile pattern name. * max length 127 characters; default value is "core"* ``core_pattern`` is used as a pattern template for the output filename; certain string patterns (beginning with '%') are substituted with their actual values.* backward compatibility with ``core_uses_pid``: If ``core_pattern`` does not include "%p" (default does not) and ``core_uses_pid`` is set, then .PID will be appended to the filename. * corename format specifiers ======== ========================================== %<NUL> '%' is dropped %% output one '%' %p pid %P global pid (init PID namespace) %i tid %I global tid (init PID namespace) %u uid (in initial user namespace) %g gid (in initial user namespace) %d dump mode, matches ``PR_SET_DUMPABLE`` and ``/proc/sys/fs/suid_dumpable`` %s signal number %t UNIX time of dump %h hostname %e executable filename (may be shortened, could be changed by prctl etc) %f executable filename %E executable path %c maximum size of core file by resource limit RLIMIT_CORE %C CPU the task ran on %<OTHER> both are dropped ======== ========================================== * If the first character of the pattern is a '|', the kernel will treat the rest of the pattern as a command to run. The core dump will be written to the standard input of that program instead of to a file. core_pipe_limit=============== This sysctl is only applicable when `core_pattern`_ is configured topipe core files to a user space helper (when the first character of``core_pattern`` is a '|', see above).When collecting cores via a pipe to an application, it is occasionallyuseful for the collecting application to gather data about thecrashing process from its ``/proc/pid`` directory.In order to do this safely, the kernel must wait for the collectingprocess to exit, so as not to remove the crashing processes proc filesprematurely.This in turn creates the possibility that a misbehaving userspacecollecting process can block the reaping of a crashed process simplyby never exiting.This sysctl defends against that.It defines how many concurrent crashing processes may be piped to userspace applications in parallel.If this value is exceeded, then those crashing processes above thatvalue are noted via the kernel log and their cores are skipped.0 is a special value, indicating that unlimited processes may becaptured in parallel, but that no waiting will take place (i.e. thecollecting process is not guaranteed access to ``/proc/<crashingpid>/``).This value defaults to 0. core_uses_pid============= The default coredump filename is "core". By setting``core_uses_pid`` to 1, the coredump filename becomes core.PID.If `core_pattern`_ does not include "%p" (default does not)and ``core_uses_pid`` is set, then .PID will be appended tothe filename. ctrl-alt-del============ When the value in this file is 0, ctrl-alt-del is trapped andsent to the ``init(1)`` program to handle a graceful restart.When, however, the value is > 0, Linux's reaction to a VulcanNerve Pinch (tm) will be an immediate reboot, without evensyncing its dirty buffers. Note: when a program (like dosemu) has the keyboard in 'raw' mode, the ctrl-alt-del is intercepted by the program before it ever reaches the kernel tty layer, and it's up to the program to decide what to do with it. dmesg_restrict============== This toggle indicates whether unprivileged users are preventedfrom using ``dmesg(8)`` to view messages from the kernel's logbuffer.When ``dmesg_restrict`` is set to 0 there are no restrictions.When ``dmesg_restrict`` is set to 1, users must have``CAP_SYSLOG`` to use ``dmesg(8)``. The kernel config option ``CONFIG_SECURITY_DMESG_RESTRICT`` sets thedefault value of ``dmesg_restrict``. domainname & hostname===================== These files can be used to set the NIS/YP domainname and thehostname of your box in exactly the same way as the commandsdomainname and hostname, i.e.:: # echo "darkstar" > /proc/sys/kernel/hostname # echo "mydomain" > /proc/sys/kernel/domainname has the same effect as:: # hostname "darkstar" # domainname "mydomain" Note, however, that the classic darkstar.frop.org has thehostname "darkstar" and DNS (Internet Domain Name Server)domainname "frop.org", not to be confused with the NIS (NetworkInformation Service) or YP (Yellow Pages) domainname. These twodomain names are in general different. For a detailed discussionsee the ``hostname(1)`` man page. firmware_config=============== See Documentation/driver-api/firmware/fallback-mechanisms.rst. The entries in this directory allow the firmware loader helperfallback to be controlled: * ``force_sysfs_fallback``, when set to 1, forces the use of the fallback;* ``ignore_sysfs_fallback``, when set to 1, ignores any fallback. ftrace_dump_on_oops=================== Determines whether ``ftrace_dump()`` should be called on an oops (orkernel panic). This will output the contents of the ftrace buffers tothe console. This is very useful for capturing traces that lead tocrashes and outputting them to a serial console. ======================= ===========================================0 Disabled (default).1 Dump buffers of all CPUs.2(orig_cpu) Dump the buffer of the CPU that triggered the oops.<instance> Dump the specific instance buffer on all CPUs.<instance>=2(orig_cpu) Dump the specific instance buffer on the CPU that triggered the oops.======================= =========================================== Multiple instance dump is also supported, and instances are separatedby commas. If global buffer also needs to be dumped, please specifythe dump mode (1/2/orig_cpu) first for global buffer. So for example to dump "foo" and "bar" instance buffer on all CPUs,user can:: echo "foo,bar" > /proc/sys/kernel/ftrace_dump_on_oops To dump global buffer and "foo" instance buffer on allCPUs along with the "bar" instance buffer on CPU that triggered theoops, user can:: echo "1,foo,bar=2" > /proc/sys/kernel/ftrace_dump_on_oops ftrace_enabled, stack_tracer_enabled==================================== See Documentation/trace/ftrace.rst. hardlockup_all_cpu_backtrace============================ This value controls the hard lockup detector behavior when a hardlockup condition is detected as to whether or not to gather furtherdebug information. If enabled, arch-specific all-CPU stack dumpingwill be initiated. = ============================================0 Do nothing. This is the default behavior.1 On detection capture more debug information.= ============================================ hardlockup_panic================ This parameter can be used to control whether the kernel panicswhen a hard lockup is detected. = ===========================0 Don't panic on hard lockup.1 Panic on hard lockup.= =========================== See Documentation/admin-guide/lockup-watchdogs.rst for more information.This can also be set using the nmi_watchdog kernel parameter. hotplug======= Path for the hotplug policy agent.Default value is ``CONFIG_UEVENT_HELPER_PATH``, which in turn defaultsto the empty string. This file only exists when ``CONFIG_UEVENT_HELPER`` is enabled. Mostmodern systems rely exclusively on the netlink-based uevent source anddon't need this. hung_task_all_cpu_backtrace=========================== If this option is set, the kernel will send an NMI to all CPUs to dumptheir backtraces when a hung task is detected. This file shows up ifCONFIG_DETECT_HUNG_TASK and CONFIG_SMP are enabled. 0: Won't show all CPUs backtraces when a hung task is detected.This is the default behavior. 1: Will non-maskably interrupt all CPUs and dump their backtraces whena hung task is detected. hung_task_panic=============== Controls the kernel's behavior when a hung task is detected.This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. = =================================================0 Continue operation. This is the default behavior.1 Panic immediately.= ================================================= hung_task_check_count===================== The upper bound on the number of tasks that are checked.This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. hung_task_timeout_secs====================== When a task in D state did not get scheduledfor more than this value report a warning.This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. 0 means infinite timeout, no checking is done. Possible values to set are in range {0:``LONG_MAX``/``HZ``}. hung_task_check_interval_secs============================= Hung task check interval. If hung task checking is enabled(see `hung_task_timeout_secs`_), the check is done every``hung_task_check_interval_secs`` seconds.This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. 0 (default) means use ``hung_task_timeout_secs`` as checkinginterval. Possible values to set are in range {0:``LONG_MAX``/``HZ``}. hung_task_warnings================== The maximum number of warnings to report. During a check intervalif a hung task is detected, this value is decreased by 1.When this value reaches 0, no more warnings will be reported.This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. -1: report an infinite number of warnings. hyperv_record_panic_msg======================= Controls whether the panic kmsg data should be reported to Hyper-V. = =========================================================0 Do not report panic kmsg data.1 Report the panic kmsg data. This is the default behavior.= ========================================================= ignore-unaligned-usertrap========================= On architectures where unaligned accesses cause traps, and where thisfeature is supported (``CONFIG_SYSCTL_ARCH_UNALIGN_NO_WARN``;currently, ``arc`` and ``loongarch``), controls whether allunaligned traps are logged. = =============================================================0 Log all unaligned accesses.1 Only warn the first time a process traps. This is the default setting.= ============================================================= See also `unaligned-trap`_. io_uring_disabled================= Prevents all processes from creating new io_uring instances. Enabling thisshrinks the kernel's attack surface. = ======================================================================0 All processes can create io_uring instances as normal. This is the default setting.1 io_uring creation is disabled (io_uring_setup() will fail with -EPERM) for unprivileged processes not in the io_uring_group group. Existing io_uring instances can still be used. See the documentation for io_uring_group for more information.2 io_uring creation is disabled for all processes. io_uring_setup() always fails with -EPERM. Existing io_uring instances can still be used.= ====================================================================== io_uring_group============== When io_uring_disabled is set to 1, a process must either beprivileged (CAP_SYS_ADMIN) or be in the io_uring_group group in orderto create an io_uring instance. If io_uring_group is set to -1 (thedefault), only processes with the CAP_SYS_ADMIN capability may createio_uring instances. kexec_load_disabled=================== A toggle indicating if the syscalls ``kexec_load`` andLines 1–500 of 1675. Load more
=================================== Documentation for /proc/sys/kernel/ =================================== .. See scripts/check-sysctl-docs to keep this up to date Copyright (c) 1998, 1999, Rik van Riel <riel@nl.linux.org> Copyright (c) 2009, Shen Feng<shen@cn.fujitsu.com> For general info and legal blurb, please look in Documentation/admin-guide/sysctl/index.rst. ------------------------------------------------------------------------------ This file contains documentation for the sysctl files in ``/proc/sys/kernel/``. The files in this directory can be used to tune and monitor miscellaneous and general things in the operation of the Linux kernel. Since some of the files *can* be used to screw up your system, it is advisable to read both documentation and source before actually making adjustments. Currently, these files might (depending on your configuration) show up in ``/proc/sys/kernel``: .. contents:: :local: acct ==== :: highwater lowwater frequency If BSD-style process accounting is enabled these values control its behaviour. If free space on filesystem where the log lives goes below ``lowwater``\ % accounting suspends. If free space gets above ``highwater``\ % accounting resumes. ``frequency`` determines how often do we check the amount of free space (value is in seconds). Default: :: 4 2 30 That is, suspend accounting if free space drops below 2%; resume it if it increases to at least 4%; consider information about amount of free space valid for 30 seconds. acpi_video_flags ================ See Documentation/power/video.rst. This allows the video resume mode to be set, in a similar fashion to the ``acpi_sleep`` kernel parameter, by combining the following values: = ======= 1 s3_bios 2 s3_mode 4 s3_beep = ======= arch ==== The machine hardware name, the same output as ``uname -m`` (e.g. ``x86_64`` or ``aarch64``). auto_msgmni =========== This variable has no effect and may be removed in future kernel releases. Reading it always returns 0. Up to Linux 3.17, it enabled/disabled automatic recomputing of `msgmni`_ upon memory add/remove or upon IPC namespace creation/removal. Echoing "1" into this file enabled msgmni automatic recomputing. Echoing "0" turned it off. The default value was 1. bootloader_type (x86 only) ========================== This gives the bootloader type number as indicated by the bootloader, shifted left by 4, and OR'd with the low four bits of the bootloader version. The reason for this encoding is that this used to match the ``type_of_loader`` field in the kernel header; the encoding is kept for backwards compatibility. That is, if the full bootloader type number is 0x15 and the full version number is 0x234, this file will contain the value 340 = 0x154. See the ``type_of_loader`` and ``ext_loader_type`` fields in Documentation/arch/x86/boot.rst for additional information. bootloader_version (x86 only) ============================= The complete bootloader version number. In the example above, this file will contain the value 564 = 0x234. See the ``type_of_loader`` and ``ext_loader_ver`` fields in Documentation/arch/x86/boot.rst for additional information. bpf_stats_enabled ================= Controls whether the kernel should collect statistics on BPF programs (total time spent running, number of times run...). Enabling statistics causes a slight reduction in performance on each program run. The statistics can be seen using ``bpftool``. = =================================== 0 Don't collect statistics (default). 1 Collect statistics. = =================================== cad_pid ======= This is the pid which will be signalled on reboot (notably, by Ctrl-Alt-Delete). Writing a value to this file which doesn't correspond to a running process will result in ``-ESRCH``. See also `ctrl-alt-del`_. cap_last_cap ============ Highest valid capability of the running kernel. Exports ``CAP_LAST_CAP`` from the kernel. .. _core_pattern: core_pattern ============ ``core_pattern`` is used to specify a core dumpfile pattern name. * max length 127 characters; default value is "core" * ``core_pattern`` is used as a pattern template for the output filename; certain string patterns (beginning with '%') are substituted with their actual values. * backward compatibility with ``core_uses_pid``: If ``core_pattern`` does not include "%p" (default does not) and ``core_uses_pid`` is set, then .PID will be appended to the filename. * corename format specifiers ======== ========================================== %<NUL> '%' is dropped %% output one '%' %p pid %P global pid (init PID namespace) %i tid %I global tid (init PID namespace) %u uid (in initial user namespace) %g gid (in initial user namespace) %d dump mode, matches ``PR_SET_DUMPABLE`` and ``/proc/sys/fs/suid_dumpable`` %s signal number %t UNIX time of dump %h hostname %e executable filename (may be shortened, could be changed by prctl etc) %f executable filename %E executable path %c maximum size of core file by resource limit RLIMIT_CORE %C CPU the task ran on %<OTHER> both are dropped ======== ========================================== * If the first character of the pattern is a '|', the kernel will treat the rest of the pattern as a command to run. The core dump will be written to the standard input of that program instead of to a file. core_pipe_limit =============== This sysctl is only applicable when `core_pattern`_ is configured to pipe core files to a user space helper (when the first character of ``core_pattern`` is a '|', see above). When collecting cores via a pipe to an application, it is occasionally useful for the collecting application to gather data about the crashing process from its ``/proc/pid`` directory. In order to do this safely, the kernel must wait for the collecting process to exit, so as not to remove the crashing processes proc files prematurely. This in turn creates the possibility that a misbehaving userspace collecting process can block the reaping of a crashed process simply by never exiting. This sysctl defends against that. It defines how many concurrent crashing processes may be piped to user space applications in parallel. If this value is exceeded, then those crashing processes above that value are noted via the kernel log and their cores are skipped. 0 is a special value, indicating that unlimited processes may be captured in parallel, but that no waiting will take place (i.e. the collecting process is not guaranteed access to ``/proc/<crashing pid>/``). This value defaults to 0. core_uses_pid ============= The default coredump filename is "core". By setting ``core_uses_pid`` to 1, the coredump filename becomes core.PID. If `core_pattern`_ does not include "%p" (default does not) and ``core_uses_pid`` is set, then .PID will be appended to the filename. ctrl-alt-del ============ When the value in this file is 0, ctrl-alt-del is trapped and sent to the ``init(1)`` program to handle a graceful restart. When, however, the value is > 0, Linux's reaction to a Vulcan Nerve Pinch (tm) will be an immediate reboot, without even syncing its dirty buffers. Note: when a program (like dosemu) has the keyboard in 'raw' mode, the ctrl-alt-del is intercepted by the program before it ever reaches the kernel tty layer, and it's up to the program to decide what to do with it. dmesg_restrict ============== This toggle indicates whether unprivileged users are prevented from using ``dmesg(8)`` to view messages from the kernel's log buffer. When ``dmesg_restrict`` is set to 0 there are no restrictions. When ``dmesg_restrict`` is set to 1, users must have ``CAP_SYSLOG`` to use ``dmesg(8)``. The kernel config option ``CONFIG_SECURITY_DMESG_RESTRICT`` sets the default value of ``dmesg_restrict``. domainname & hostname ===================== These files can be used to set the NIS/YP domainname and the hostname of your box in exactly the same way as the commands domainname and hostname, i.e.:: # echo "darkstar" > /proc/sys/kernel/hostname # echo "mydomain" > /proc/sys/kernel/domainname has the same effect as:: # hostname "darkstar" # domainname "mydomain" Note, however, that the classic darkstar.frop.org has the hostname "darkstar" and DNS (Internet Domain Name Server) domainname "frop.org", not to be confused with the NIS (Network Information Service) or YP (Yellow Pages) domainname. These two domain names are in general different. For a detailed discussion see the ``hostname(1)`` man page. firmware_config =============== See Documentation/driver-api/firmware/fallback-mechanisms.rst. The entries in this directory allow the firmware loader helper fallback to be controlled: * ``force_sysfs_fallback``, when set to 1, forces the use of the fallback; * ``ignore_sysfs_fallback``, when set to 1, ignores any fallback. ftrace_dump_on_oops =================== Determines whether ``ftrace_dump()`` should be called on an oops (or kernel panic). This will output the contents of the ftrace buffers to the console. This is very useful for capturing traces that lead to crashes and outputting them to a serial console. ======================= =========================================== 0 Disabled (default). 1 Dump buffers of all CPUs. 2(orig_cpu) Dump the buffer of the CPU that triggered the oops. <instance> Dump the specific instance buffer on all CPUs. <instance>=2(orig_cpu) Dump the specific instance buffer on the CPU that triggered the oops. ======================= =========================================== Multiple instance dump is also supported, and instances are separated by commas. If global buffer also needs to be dumped, please specify the dump mode (1/2/orig_cpu) first for global buffer. So for example to dump "foo" and "bar" instance buffer on all CPUs, user can:: echo "foo,bar" > /proc/sys/kernel/ftrace_dump_on_oops To dump global buffer and "foo" instance buffer on all CPUs along with the "bar" instance buffer on CPU that triggered the oops, user can:: echo "1,foo,bar=2" > /proc/sys/kernel/ftrace_dump_on_oops ftrace_enabled, stack_tracer_enabled ==================================== See Documentation/trace/ftrace.rst. hardlockup_all_cpu_backtrace ============================ This value controls the hard lockup detector behavior when a hard lockup condition is detected as to whether or not to gather further debug information. If enabled, arch-specific all-CPU stack dumping will be initiated. = ============================================ 0 Do nothing. This is the default behavior. 1 On detection capture more debug information. = ============================================ hardlockup_panic ================ This parameter can be used to control whether the kernel panics when a hard lockup is detected. = =========================== 0 Don't panic on hard lockup. 1 Panic on hard lockup. = =========================== See Documentation/admin-guide/lockup-watchdogs.rst for more information. This can also be set using the nmi_watchdog kernel parameter. hotplug ======= Path for the hotplug policy agent. Default value is ``CONFIG_UEVENT_HELPER_PATH``, which in turn defaults to the empty string. This file only exists when ``CONFIG_UEVENT_HELPER`` is enabled. Most modern systems rely exclusively on the netlink-based uevent source and don't need this. hung_task_all_cpu_backtrace =========================== If this option is set, the kernel will send an NMI to all CPUs to dump their backtraces when a hung task is detected. This file shows up if CONFIG_DETECT_HUNG_TASK and CONFIG_SMP are enabled. 0: Won't show all CPUs backtraces when a hung task is detected. This is the default behavior. 1: Will non-maskably interrupt all CPUs and dump their backtraces when a hung task is detected. hung_task_panic =============== Controls the kernel's behavior when a hung task is detected. This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. = ================================================= 0 Continue operation. This is the default behavior. 1 Panic immediately. = ================================================= hung_task_check_count ===================== The upper bound on the number of tasks that are checked. This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. hung_task_timeout_secs ====================== When a task in D state did not get scheduled for more than this value report a warning. This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. 0 means infinite timeout, no checking is done. Possible values to set are in range {0:``LONG_MAX``/``HZ``}. hung_task_check_interval_secs ============================= Hung task check interval. If hung task checking is enabled (see `hung_task_timeout_secs`_), the check is done every ``hung_task_check_interval_secs`` seconds. This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. 0 (default) means use ``hung_task_timeout_secs`` as checking interval. Possible values to set are in range {0:``LONG_MAX``/``HZ``}. hung_task_warnings ================== The maximum number of warnings to report. During a check interval if a hung task is detected, this value is decreased by 1. When this value reaches 0, no more warnings will be reported. This file shows up if ``CONFIG_DETECT_HUNG_TASK`` is enabled. -1: report an infinite number of warnings. hyperv_record_panic_msg ======================= Controls whether the panic kmsg data should be reported to Hyper-V. = ========================================================= 0 Do not report panic kmsg data. 1 Report the panic kmsg data. This is the default behavior. = ========================================================= ignore-unaligned-usertrap ========================= On architectures where unaligned accesses cause traps, and where this feature is supported (``CONFIG_SYSCTL_ARCH_UNALIGN_NO_WARN``; currently, ``arc`` and ``loongarch``), controls whether all unaligned traps are logged. = ============================================================= 0 Log all unaligned accesses. 1 Only warn the first time a process traps. This is the default setting. = ============================================================= See also `unaligned-trap`_. io_uring_disabled ================= Prevents all processes from creating new io_uring instances. Enabling this shrinks the kernel's attack surface. = ====================================================================== 0 All processes can create io_uring instances as normal. This is the default setting. 1 io_uring creation is disabled (io_uring_setup() will fail with -EPERM) for unprivileged processes not in the io_uring_group group. Existing io_uring instances can still be used. See the documentation for io_uring_group for more information. 2 io_uring creation is disabled for all processes. io_uring_setup() always fails with -EPERM. Existing io_uring instances can still be used. = ====================================================================== io_uring_group ============== When io_uring_disabled is set to 1, a process must either be privileged (CAP_SYS_ADMIN) or be in the io_uring_group group in order to create an io_uring instance. If io_uring_group is set to -1 (the default), only processes with the CAP_SYS_ADMIN capability may create io_uring instances. kexec_load_disabled =================== A toggle indicating if the syscalls ``kexec_load`` and